Repository metrics
- Stars
- (5,181 stars)
- PR merge metrics
- (PR metrics pending)
Description
What is the problem you are trying to solve?
Hi Grafana-Labs
We're working on upgrading to Ingest-Storage using MSK as our Kafka backend and we're testing IAM auth introduced in 3.1 but it doesn't support IRSA auth similar to block-storage S3.
For block-storage we simply don't set static-credentials and Mimir uses the IAM role of the service account associated with the Pod, but this doesn't work for Kafka as we hit the following validation error: https://github.com/grafana/mimir/blob/main/pkg/storage/ingest/config.go#L40
We can work around this by creating a socket to get the credentials but ideally we could just rely on IRSA auth of the Service Account.
Which solution do you envision (roughly)?
Kafka code path can handle auth to AWS MSK clusters in a similar manner to how it handles AWS S3 auth, that when no config fields are set it tries to use IRSA auth for the Pods Service Account.
Have you considered any alternatives?
No response
Any additional context to share?
No response
How long do you think this would take to be developed?
Small (<= 1 month dev)
What are the documentation dependencies?
No response
Proposer?
No response